Sri LankaReporting of Information Technology and Cybersecurity Incidents of Licensed Banks
Central Bank of Sri Lanka Circular No. 02 of 2025 (Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks) paragraphs 2 to 5 and Annexes 01 to 03
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every licensed commercial bank and licensed specialised bank (reached by declaring that you are a bank).
- Report an IT or cybersecurity incident to the Director, Bank Supervision Department, at techrisk.bsd@cbsl.lk, copying dbsd@cbsl.lk, in the Annex 01 format within 2 hours of detecting it (paragraph 4, Table 01).
- Send the detailed report in the Annex 02 format, with a root cause analysis and the corrective actions taken, within 14 days of detecting the incident; the Annex 02 guidelines say 14 working days (paragraph 4, Table 01, and Annex 02).
- Send the quarterly report in the Annex 03 format within 15 days after the end of each quarter (paragraph 4, Table 01).
- Report at least these categories: intrusion or hacking, malware, ransomware, malicious code, viruses, phishing, denial of service attacks, social engineering, unauthorized system usage, insider threats, advanced persistent threats and supply chain attacks; online or digital scams affecting customers; unplanned critical system outages or failures; and regulatory non-compliances relating to IT and cybersecurity requirements (paragraph 3).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
- Open questions
- Is the detailed report due within 14 days or within 14 working days of detection, since Table 01 of the Circular and the Annex 02 guidelines state the period differently?
What this law does
Circular No. 02 of 2025 of the Central Bank of Sri Lanka is issued to licensed commercial banks and licensed specialised banks. The Circular is dated . The Circular requires licensed banks to report IT and cybersecurity incidents to the Director, Bank Supervision Department, by email. The Circular sets three clocks: an immediate report within 2 hours of detection, a detailed report within 14 days of detection, and a quarterly report within 15 days after the end of each quarter.
The Circular defines a cybersecurity incident as an event that compromises the confidentiality, integrity or availability of a bank’s systems and information. The Circular revokes the Central Bank’s circular of 25.01.2016 on reporting cybersecurity events.
When LexLint raises it
When your app profile says your app is a bank.